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METHOD AND SYSTEM FOR CONTENT IDENTIFICATION OF FILES IN A 

NETWORK 

Technical field of the Inve ntion . _ — — 

The invention relates to a method and system to control the content of 
5 computer files, e.g. containing text or graphical data. More specifically, a 
method and system is described for checking and managing the security 
status and the content of computer files on a local computing device in a 
network environment. 

- Background of the invention 

10 In today's world, computers are widely spread. Very often, especially in 

business environment, they are interconnected in small or larger networks. As 
software and data often are an important part of the investment goods of both 
private persons and fimns, it is important to protect single computing devices 
and complete networks and their wortcstations against attacks from viruses, 

1 5 trojan horses, worms and malicious software. Another problem is related to the 
amount of files containing undesirable content such as explicit aduH content. 
These files are often received on local computing devices uninvited and 
unwanted. 

To solve the security problems associated with viruses, virus protection 
20 systems, also called virus checkers, have been developed. Some examples of 
conventional virus checkers are Norton AntiVims, McAfee VirusScan, PC-cillin, 
Kaspersky Anti-Virus. Most of these conventional virus protection software 
packages can be configured so that they are continuously running in the 
background of the computing device and providing continuous protection. 

25 These vims protection systems compare codes of new or amended software 
with fingerprints (e.g. parts of code introduced in files by the viruses) of well 
known viruses. Other vims protection systems compare codes of all data 
available on the computing device. This leads to the use of a significant 
amount of central processing unit (CPU) time, which limits the capacity of the 

30 computing device for perfomiing other tasks. Furthemnore, the working 
principle of these vims checkers makes these software packages work rather 
reactive than proactive, as the fingerprint of the vims needs to be known in 
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order for a virus scanning program to recognise it. This implies that the 
database of fingerprints needs to be updated very regularly in order to be 
^^^red against relatively new viruses. Consequently, the secure state of the 
computer is not only depending on external factor s like the accurateness wF trT 
5 which fingerprints of new viruses are made available by the suppliers of virus 
protection software packages, but also on the sense of duty of the user 
regarding performing updates regularly. If updates are provided centrally from 
a server automatically, then network capacity is reduced as these vims 
updates must be sent to each workstation. 
10 In a network environment, the problem of updating such a database of 

fingerprints becomes significantly more important, as it implies that the 
responsibility is put to all users, who all have to update their virus checker 
database. Alternatively, the vims scanning could be performed by a central 
server, thus limiting the updating for new fingerprints to the central server. 
15 Nevertheless this implies that a large amount of data needs to be transferred 
over the network on a regular basis thereby utilising large amounts of 
expensive network bandwidth and possibly (depending on the number of 
clients for the server) overloading the network or server capacity for other 
activities. 

20 In order to limit the amount of CPU time used, additional techniques 

have been developed to speed up the vims scanning process. These very 
often include hashing of the content of files. Hashing is one example of 
application of a "one-way-function". A one-way-function is an algorithm which 
when applied In one direction makes the reverse direction almost impossible to 

25 perform. A one-way-function generates a value such as a hash value by a 
calculation on the content of a file and can uniquely fingerprint this file if the 
one-way-function is complex enough to avoid duplicate values ft-om different 
files. The uniqueness of a hashing function depends on the type of hashing 
function that is used, i.e. the size of the digest that is formed and the quality of 

30 function. Good hashing functions have the fewest collisions in a table, i.e. the 
chance of providing the same hash value for different files is the smallest. As 
mentioned, this is also determined by the size of the digest, i.e. hash value, 
that is calculated. If e.g. a 128-bit digest is used, the number of possible 
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different values that can be obtained is 2 . 

It is known to use hashing for virus checking, possibly in a network 
environment Typically, a hash of an application selected to run on a local 

computer is calculated, a stored hash from a database on a secured computer 

5 is retrieved on the local computer, whereby the secured computer can be a 
secured part of the local computer or a network server, and both values are 
compared. If there is a match, the application is executed, if there is no match, 
a security action is performed. This security action comprises loading a virus 
scanner on the local computer. It may also comprise alerting the network 
10 administrator. Furthennore it is also known to use this for differentiating 
accessibility to software from different workstations and as a way of checking 
whether software is licensed. 

It is also known to use hashing in a method of identifying rogue software 
on a computer system or device. The method typically is applicable in a 
15 network environment. A hash value of a software application to be executed is 
calculated, this hash value is transferred to a sender and compared with 
previously stored values. One of the essential features is that the method uses 
a database on a server, the server being a server with a large number of 
clients. The database on the server thereby is built up by adding infonnation by 
20 different clients so that most software applications and their corresponding 
fingerprints are already stored in the database. The database is built up by 
checking software applications on authenticity with the owners of the 
application. If this is not possible, the system is also able to give a heuristic 
result, evaluating the occurrence of this application on local computers from 

26 other clients. 

Methods for sending an electronic file by electronic mail. i.e. e-mail, 
including a file content and message content identifier are known. Depending 
on the message content identification, the message is delivered to a customer 
or not. The method may be used to organise e-mail delivery, but it has the 
30 disadvantage of being focussed on e-mail delivery and it does not allow to 
secure all files in a network. 

Monitoring of electronic mail messages, to protect a computer system 
for protection against virus attacks and unsolicited commercial e-mail (UCE) is 
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also known. Such a system is preferably installed on a mail server or an 
Internet Service Provider and checks specific parts of e-mails by calculating a 
digest a nd comparing it with stored digest values of e-mails previously 
received. In this way it is determined whether the e-mail has an approved 
digest or whether the e-mail is UCE or contains a e-mail worm. The system 
has the disadvantage that it is focussed on e-mail viruses and SPAM and that 
it does not allow to check all data files or executable files which are possibly 
infected, e.g. by files copied from external memory storage means like floppy 
disks or CD-ROMs or by e.g. Trojan horses. 

Controlling the execution of software on different workstations according 
to certain policy rules by a network server is known, whereby an improved 
computer security system is obtained, by classifying software. It is suggested 
that this classification can be based on several forms of data one of which is 
e.g. the hash values of software data. This typically is performed by the 
calculation of hash values of a program if it is selected for loading and 
execution, and comparison of the hash value with a trusted value to determine 
the rule of execution. The classification also may be based on a hash of the 
content, a digital signature, the file system or network path or the URL zone. . 

The above mentioned methods and systems describe the use of 
hashing functions to check whether software applications are authentic or to 
regulate the execution of software applications. Nevertheless the problem of 
virus scanning all new files in a network using a conventional virus scanner 
whereby the necessity of updating the database of fingerprints of a 
conventional virus scanner on every local computer is limited is not discussed. 

Summary of the invention 

It is an object of the present invention to provide a system and a method 
for identifying the content of files new on local computing devices in a network 
while limiting the necessity of updating the information needed by a content 
identifier on every local computing device. 

It is an advantage of the present invention that, if the invention is used 
as a virus checker, the security level is further increased as the database of 
fingerprints of a conventional virus scanner does not have to be updated on 
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every local computing device. 

It is a specific advantage of the present invention that the content of a 
file new to a network is only identified once for the whole network. 

It is flirthenDore a specific advantage or tne present invention that the 



5 total processor (CPU) processing time in the network and the amount of 

network traffic is reduced. 

The above described object and advantages are obtained with a 
method and system of content identification In a network according to the 
present Invention. 

10 The method for identifying the content of a data file in a network 

environment is used for a network having at least one local computing device 
linked to a remaining part of the network environment including a central 
Inirastructure. The method and system comprises calculating a reference value 
for a new file on one of said at least one local computing devices using a one- 
15 way-function, transmitting said calculated reference value to said central 
infrastnjdure, comparing said calculated reference value with reference values 
previously stored within the remaining part of the network environment. 

The method further comprises, 
after comparing, deciding that the content of the new file is already identified if 
20 a match between said calculated reference value and a previously stored 
reference value is found and retrieving the corresponding content attributes; or 
deciding that the content of the new file is not yet Identified if no match 
between said calculated reference value and any of the previously stored 
reference values is found, followed by said central infrastmcture identifying the 
25 content of said new file and determining content attributes corresponding with 
the content of the new file and storing a copy of said content attributes, 
after deciding, triggering an action on said local computing device in 
accordance with said content attributes. 

In the method for identifying the content of a data file in a network 
30 environment, the reference value may be a hash value. The reference values 
previously stored may be stored within the central infrastructure. In the method 
and system for identifying the content of a data file in a network environment, 
identifying the content of the new file may comprise scanning the new file for 



6 



viruses using an anti-virus checker means on a central infrastructure. 

The method may furthermore comprise transferring the new file from the 
local computing device to the central infrastructure before said identifying the 



content of said new file is performed. Furthermore it may comprise storing a 
5 copy of the new file on the central infrastructure after transferring the new file 
from the local computing device to the central infrastructure. An address of 
where the file is stored may be stored together with the hash value, as to be 
able to quickly track copies of the files stored on the central Infrastructure. 

In the method of the present invention, triggering an action on the local 

10 computing device in accordance with said content attributes may comprise 
replacement of the new file on the local computing device with a copy of a 
previous version of said new file. Furthermore, triggering an action on the local 
computing device in accordance v«th said content attributes may also 
comprise replacement of the new file on the local computing device with 

1 6 another version of said new file restored from the remaining part of the network 
environment. 

The method of the present invention furthermore may comprise sharing 
the new file on the local computing device to the central infrastructure before 
said identifying the content of said new file is performed and whereby said 
20 identifying the content of said new file is performed by remotely identifying the 
content over the network environment. The method may comprise checking 
the functioning of the local agent on the local computing device. 

Furthermore, triggering an action on the local computing device may be 
pert'ormed after transmitting the content atfributes corresponding to the new 
25 file to the local computing device. 

In the method for Identifying the content of a data fiie in a networi< 
environment, identifying the content of the new file may comprise one or more 
of the group of scanning for adult content, scanning for Self Promotional 
Advertising Messages or Unsolicited Commercial E-mail (UCE) and scanning 
30 for copyrighted information. The method may further relate to a method and 
system for providing a content firewall, whereby one local computing device is 
connected to the external network, which may e.g. be the internet, and the one 
local computing device is also connected to the network environment formed 
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by the remaining local computing devices. The one local computing device 
thus links the network environment with an external network and is the only 
computing device that is directly connected to sources external from the 
network environment. The local computing device thus acts as a content 
6 firewall as to protect the network environment from attacks originating from 
places in the external network. The local computing device may act as a 
content firewall working in a promiscuous way, i.e. whereby the local 
computing device acts as a content firewall that sees all traffic passing by, 
executes the hashing and comparing functions and contacts the agents to 

1 0 enforce a policy. 

The method may be specifically related to a method for checking the 
security status of a network and its components. In this embodiment, a method 
for determining the security status of a data file in a network environment is 
used in a network having at least one local computing device linked to a 
15 remaining part of the network environment including a central infrastructure. 
The method comprises calculating a reference value for a new file on one of 
the at least one local computing devices using a one-way-function, transmitting 
said calculated reference value to said central infrastmcture. comparing said 
calculated reference value with reference values previously stored within the 
20 remaining part of the network environment and after comparing, deciding that 
the security status of the file has already been checked if a match between the 
calculated reference value and a previously stored reference value is found 
and retrieving the corresponding security status; or deciding that the security 
status of the new file is not yet identified if no match between said calculated 
25 reference value and any of the previously stored reference values is found, 
followed by said central infrastructure checking the security status of the new 
file and determining the security status corresponding with the new file and 
storing a copy of the security status, followed by 

after deciding, triggering an action on said local computing device in 
30 accordance with the security status of the new file. This action may be e.g. 
making the file inaccessible for the user of the local computing device and for 
other users in the network or restoring the infected file. 

The methods described above may be triggered by an action performed 
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on the local agent. The triggering by an action performed on the local agent 
may be e.g. running an application or opening a file. 

The invention also relates to a method for altering a sys tem for 

identifying the content of a file in a network environment according to the 
systems described above, the network environment comprising means for 
calculating a one-way function, at least one local computing device linked to a 
remaining part of the network environment including a central infrastructure 
and means for identifying the content and. the method comprising altering said 
means for identifying the content or said means for calculating a one-way 
function, scanning the remaining part of the network environment for reference 
values calculated with a one-way function and for each of the reference 
values, requesting a file that corresponds with said reference value from said 
networtc environment, sending the file to means for Identifying the content, 
identifying the content of said file and determining content attributes 
conresponding with the content of the file and storing a copy of said content 
attributes, sending the content attributes to every local computing device 
containing the file and after sending; triggering an action on said local 
computing device in accordance with said content attributes. Altering of a 
system for identifying the content of a file in a network environment may be 
triggered by the introduction of a new one-way function to calculate reference 
values or may be also triggered by the updating of the means for identifying 
the content of the files. The method may be used to scan only part of the 
hashing keys in the remaining part of the network environment, e.g. hashing 
keys of files of which the content is identified after a certain date, as to 
minimise the actions to be performed. The date of the previous content 
identification may be retrieved from the content attributes. 

The reference values may be hashing values. The means for identifying 
the content may be an anti-virus checker means, a means for scanning for 
adult content, a means for scanning for Self Promotional Advertising 
Messages or a means for scanning for copyrighted information. Triggering an 
action on the local computing device in accordance with said content attributes 
may comprise replacement of the file on the local computing device with 
another version of the file restored from the remaining part of the network 
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environment or may comprise replacement of a file with a copy of a previous 
version of the file or may comprise putting the file in quarantine or removing 

the file. ^ 



The invention is also related to a computer program product for 
5 executing any of the above described methods, when executed on a network. 
The invention furthermore relates to a system for identifying the content of a 
file in a network environment, said network environment comprising at least 
one local computing device linked to a remaining part the network environment 
virfiich includes a central infrastructure and. said remaining part including a 
10 stored database, whereby the system comprises means for calculating a 
reference value for a new file on said local computing device using a one-way- 
function, means for transmitting said calculated reference value to said central 
infrastructure and means for comparing said calculated reference value with 
previously stored reference values from the database. The system furthermore 
15 comprises means for deciding whether the content of the new file is already 
identified based on comparison of said calculated reference value and 
reference values previously stored within the remaining part, means located on 
the central infrastructure, for Identifying the content of the new file and as to 
assign content attributes if the new file has not been identified yet and means 
20 for storing said content attributes within the remaining part, and means for 
triggering an action on said local computing device in accordance with content 
attributes for said new file. 

In the system according to the present invention, the means for 
identifying the content of a file may comprise an anti-virus checker means on 
26 said central infrastructure. Furthermore, means for storing a copy of tt>e new 
file within the remaining part. The means for identifying the content of a file 
may comprise one or more of the group of means for scanning for adult 
content, scanning for Self Promotional Advertising Messages and scanning for 
copyrighted information. 
30 The invention may also relate to a machine readable data storage 

device, storing the computer program product for executing any of the above 
described methods, when executed on a networic. Furthermore, the invention 
may also relate to the transmission of the computer program product for 
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executing any of the above described methods. 

Although there has been constant improvement, change and evolution 
of methods of virus scanning and content identification of data files, the 
present concepts are believed to represent substantial new and novel 
improvements, including departures from prior practices, resulting in the 
provision of more efficient, stable and reliable methods of this nature. 

These and other characteristics, features and advantages of the present 
invention will become apparent from the following detailed description, taken in 
conjunction with the accompanying drawings, which illustrate, by way of 
example, the principles of the invention. This description is given for the sake 
of example only, without limiting the scope of the invention. The reference 
figures quoted below refer to the attached drawings. 

Brief description of the drawings 

Fig. 1 is a schematic representation of a computer network 
Fig. 2 is a schematic representation of a central infrastructure and its 
basic software components 

Fig. 3 is a schematic representation of a local agent-driven content 
identification process. 

Fig. 4 is a schematic representation of a metabase-driven content 
identification process. 

Fig. 5 is a schematic representation of a computer networi< to which the 
content fifewair system and method can 1d& applied. 

In the different figures, the same reference figures refer to the same or 
analogous elements. 

Description of illustrative embodiments 

The present invention will be described with respect to particular 
embodiments and with reference to certain drawings but the invention is not 
limited thereto but only by the claims. The drawings described are only 
schematic and are non-limiting. In the drawings, the size of some of the 
elements may be exaggerated and not drawn on scale for illustrative purposes. 
Where the term "comprising" is used in the present description and claims, it 
does not exclude other elements or steps. 
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Furthermore, the terms first, second, third and the like In the description 
and in the claims, are used for distinguishing between similar elements and not 
necessarily for describing a sequential or chronological order, it is to be 
understood that the terms so used are interchangeable under appropriate 
circumstances and that the embodiments of the invention described herein are 
capable of operation in other sequences than described or illustrated herein. 

In this description, the terms "file", "program", "computer file", "computer 
program", "data file" and "data" are used interchangeably, and any one use 
may imply the other terms, according to the context used. The terms "hash" 
and "hashing" will be used as examples of the application of one-way-functions 
but the present invention is not limited to a particular form of one-way-function. 

The term "computing device" should be interpreted widely to include any 
device capable of canying out computations and/or executing algorithms. A 
computing device may be any of a laptop, workstation, personal computer, 
PDA. smart phone, router, network printer or any other device which has a 
processor and can be connected to a network such as e.g. faxing devices or 
copiers or any dedicated electronic device such as a so-called "hardware 

firewall" or a modem. 

The method and system to secure and control a network by identifying 
the content of each new file in the network can be used on any type of 
network. This may be a private network which may be a virtual private networi^ 
a local area network (LAN) or a wide area network (WAN). This may also be 
within a part of a public wide area network such as the Intemet. If a part of a 
public wide area network is used, this may be performed by remotely providing 
the method and system for identifying the content of each file by a service 
provider using an ASP or XSP business model, wherein the central 
Infrastnjcture is provided to a paying client operating a local computing device. 
An exemplary network 10 is shown in figure 1, showing several local 
computing devices 50a, 50b. .... 50i and a central infrastructure 100, also 
called a server. The number of local compuUng devices 50 connected to the 
network 10 is not limiting for the method of securing and controlling a network 
10 according to the current invention. In business environment this number of 
local computing devices 50 typically ranges from a few to a few thousands. 
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The method and system for Identifying the content of each new file present in 
the network 10 may be used with many different operating systems such as 
Microsoft DOS, Apple Macintosh OS. OS/2. Unix. DataCenter-Technologies' 
Operating Systems, ... ~ 

In order to provFde a quick method of securing and determining content 
identification of files, the method and system according to the present 
invention will determine hash values of new files present on the local 
computing devices 50, compare them with previously stored hash values and 
file information on a central server and determine the content of files new to 
the network 10 using a content identifying engine on the central infrastructure 
100. The content attributes describing the content of a new file are then send 
to the local computing device 50 where an appropriate action is performed. It is 
also possible that the content attributes are not sent to the local computing 
device 50 but that the appropriate action is triggered from the central 
Infrastructure 100. New files typically are files wherein new content has been 
generated on a local computing device 50 or when an external file has been 
received. The wording "file" may refer to data as well as to software 
applications, also called software. 

The central infrastructure 100 contains a database, also called 
metabase 110, which contains a record for every hash value that is calculated 
for a file that already exists on one of the local computing devices 50. Besides 
the hash value, this record also contains a number of other fields. In these 
fields, file source infonnation is stored. The file source information 
corresponding with a specific hash value includes the file name, a list of local 
computing devices 50 where the files that correspond to this hash value are 
residing on, including the path to the file on the file system of the local 
computing devices 50 and the date of last modification. An example of file 
source information for a specific file is given in Table 1 . 



Filename 


Myexampleword.doc 


Path 


c:\data\ 


Assetname 


PCmarketingOOl 
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ModDate 



23/4/2002 



Table 1 



In a further field, a list of content attributes that identifies the type of 
content that Is enclosed by the file is stored. The content attributes can e.g. 
refer to a file that contains a virus, a file that is a copyrighted MP3 audio file, a 
file that is a copyrighted video file, a file that is a picture, a file that is a picture 
that might contain adult content, a file that is a Self Promotional Advertising 
Message (SPAM), a file that is a HOAX, a file containing explicit lyrics or a file 
containing pieces of executable code. This list is not limiting. 

The central infrastructure 100 furthennore contains a content 
identification engine 120. This can be a software application 130 or a set of 
software applications 130a. 130b, 130c, 130d. ... that use the content of a file 
to determine which type of content the file contains. These software 
applications may be various : 

- a virus scanner : this is a piece of software that scans the content of 
the presented file and compares it with a database of known fingerprints of 
viruses. This can be any conventional virus scanning software like e.g. Norton 
anti-virus by Symantec Corporation, McAfee by Networic Associates 
Technologies Inc.. PC-cillin by Trend Micro. Kapersky Anti-Vims by Kaspersky 
Lab, F-secure Anti-Virus by F-Secure Corporation. ... 

- an adult content in pictures scanner : this is a piece . of software that 
scans the content of the presented file for the presence of shading, colors, 
textures that might represent adult content. Scanning pictures for adult content 
is already known. Content adult can e.g. be determined by the amount of nude 
that is shown. Skin tones have hue-saturation values that are in a specific 
range. Therefore, if an image is scanned, it is possible to determine the 
amount of pixels having a skin tone character and to compare it with the total 
number of pixels. The ratio of skin tone pixels to the total number of pixels 
allows to detemiine a ratio of possible adult content in an image. Thresholds 
often are introduced so that images can be classified according to their 
possible adult content. In similar way, video images can be categorised, 
whereby the video is split into its different frames and wherein the images are 
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categorised according to the above method. 

- A scanner for internet content ratings : A piece of software that scans 
objects for adult content based on the PICS, i.e. the Platform for Internet 
Content Selection, label system. On voluntary basis, Internet content providere 
can provide internet objects with a PICS rating determining the adult content in 
the internet object. This PICS rating is stored in the meta data of the object. 
This data nomnally is not visible to the viewer of an internet object. The rating 
systems is well known and an example of a scanner for internet content ratings 
Is provided in the Netscape web browser for scanning the content of web 
pages. 

- A scanner for scanning an object for explicit lyrics which may indicate 
adult content. This is known for both text files and audio files. Audio files are 
first transferred to text files. Subsequently, the text files are scanned and 
compared with databases which contain explicit lyrics. 

- a SPAM-engine: A piece of software that scans the content of e-mail 
messages for the presence of unalleged SPAM. Algorithms to recognize 
SPAM area already known. These are typically based on decomposing the text 
in an electronic mail message, associating statistics with the text using a 
statistical analyzer and coupling a neural network engine to the statistical 
analyzer to recognize unwanted messages based on statistical indicators. 
Other examples of software applications that could be used in the content 
identification engine 120 are e.g. engines that scan for copyrighted content 
and that compares the content of the file to a database of copyrighted 
information, etc. In some adoptions, a human operator can pursue the role of 
content identificatiori engine 120, where he manually tags a file with a content 
identification attribute. When the content identification engine 120 is activated, 
it will take a file from the local agent as input and produce a set of attributes 
that represent the detected content. 

The content Identification engine 120 will thus be constructed as a piece 
of software aggregating the functionality of a set of third party engines. 

In a further embodiment of the invention, a system and method in 
accordance with the above embodiment is described whereby the record 
corresponding with a specific hash value stored in the metabase 110 also 
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comprises a field wherein the location of the file on the central infrastructure 
100 corresponding with the hash value is stored. In this embodiment, a copy of 
all different files present on the local computing devices 50 in the network 10 is 



stored on the central infrastructure 100. So. the central infrastructure 100 of 
this embodiment also comprises a large amount of storing space. This 
preferably is a secured part of the central infrastructure 100, not direcUy 
connected to the network 10 so that these identical copies of the files present 
on the local computing devices 50 can be used in case the files on the local 
computing devices 50 are corrupted e.g. by a virus. 

The hash value of the files are calculated using a hashing function. A 
hashing function typically is a one way function, i.e. given the digest, it is at 
least computationaly prohibitive to reconstruct the original data. Different types 
of hashing functions could be used : MD5. SHA-1 or ripemd all available from 
RSA Data Security Inc.. haval which is designed at the University of 
Wollongong. snefru which is a Xerox secure hash function, etc.. The hashing 
functions most often used are MD5 and SHA-1. The MD6 algorithm takes as 
input a message of arbitrary length and produces as output a 128-bit 
"fingerprint- or "message digest" of the input. It is conjectured that it is 
computationally infeasible to produce two messages having the same 
message digest, or to produce any message having a given pre-specified 
target message digest. The MD5 algorithm is intended for digital signature 
applications, where a large file must be 'compressed' in a secure manner 
before being encrypted with a private (secret) key under a public-key 
cryptosystem. The MD5 algorithm is designed to be quite fast on 32-bit 
machines. In addition, the MD5 algorithm does not require any large 
substitution tables; the algorithm can be coded quite compactly. An alternative 
hashing function SHA-1. i.e. Secure Hashing Algorithm - 1, is a hashing 
algorithm generating a 160-bit hash. Newer versions of this algorithm also 

provide bit lengths of 256 and 512. 

In the above mentioned embodiments describing a method and system 
to secure and/or control the network 10. a local agent is installed on the local 
computing device 60. The local agent is a piece of software that is running on 
a local computing device 50 and that performs certain algorithms and 
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procedures. The local agent on the local computing device 50 is triggered 
typically in situations where new content is being generated on local computing 
devices 50. In order to avoid unnecessary hash value calculations and data 
transfer, a policy is setup to determine which actions will trigger the local agent 
and which actions do not trigger it. If e.g. a text document is being created, it is 
not necessary to check the file ©very time the document is saved. The policy 
for such a type of documents would preferably be that the document is 
checked e.g. if the file is both saved and closed. Some examples of actions 
which could trigger the local agent and thus start the content identification 
process are opening or receiving e-mail messages, opening or receiving e-mail 
attachments, running executable files, running files with .dll or .piff extension 
... Applying this policy thus allows to prevent from continuously checking and 
scanning of documents leading to a limitation of the number of unnecessary 
hash calculations and content Identification operations and thus limiting the 
unnecessary use of CPU time and load on the network traffic. The method and 
system of content identification is not limited due to the type of application in 
which the file is made. 

The content identification process can be either triggered by the local 
agent on the local computing device 50 or it can be triggered by the central 
infrastructure 100. The latter process typically occurs in situations wherein new 
algorithms or tools are being used for content identification. Such new 
algorithms or tools can either be optimised algorithms and tools or previously 
uninstalled tools. Some examples of these tools, without restricting to these 
functions, could be virus checking, checking whether a file is a copyrighted 
MPS Audio File, checking whether a file is a copyrighted Video File, checking 
whether a file is a picture that might contain adult content, checking whether a 
file is tagged as being SPAM or HOAX, checking whether a file contains 
explicit lyrics or checking whether a file contains copyrighted pieces of 
executable code. Updating of these tools may influence the status of the files 
and thus may in principle influence the corresponding records in the metabase 
110. Therefore, depending on the type of update of the content identification 
means 120, it may be interesting to update the corresponding records. 

In a specific embodiment, the method relates to a virus checker for a 
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network environment The networks 10 on which this method can be applied 
are the same as those described for the previous embodiments. The local 
agent calculates the hash value of a new file on the local computing device 50. 



This new file may comprise new content generated on the local computing 
device 50 or an external file which is received on the local computing device 
50. The hash value of the new file and the corresponding file information then 
is sent to a central infrastructure 100, also called server, where it is compared 
to previously stored hash values con-esponding with files that are already 
present on the different local computing devices 50 of the network 10. This 
comparison allows to check whether the file is new or not In the entire network 
10. Alternatively, the hash value may also be first compared with a local 
database of hash values and file information corresponding with the files 
present on that particular local computing device 50 and subsequently, if the 
file has been found not yet present on the local computing device 50, the hash 
value and the con-esponding file infomnation may be interchanged with the 
central infrastructure 100 so it can be checked whether the file is new or not in 
the entire network 10. Although transferring the file information and the hash 
value of every new file only corresponds with a very small fraction of the 
network traffic for a conventional central virus checker, this alternative could 
reduce the network traffic used for vims checking even fijrther. If a hash value 
has been identified as new on the network 10, the metabase agent triggers the 
local agent to transfer the file con-esponding with the new hash value from the 
local computing device 50 to the central infrastructure 100. The transfemng of 
the file may be performed In a secured way. i.e. the file may be transferred 
such that it cannot be Influenced by a virus present at a network connection or 
such that, it if contains a virus, this cannot be spread over the whole network 
10. To obtain this, a known secure transmission route, a tunnel and/or known 
session ecryption/decryptlon techniques may be used. A conventional virus 
checker, installed and updated on the central infrastructure 100 then checks 
the file for viruses. This can be any conventional vims checker like e.g. Norton 
anti-vims by Symantec Corporation. McAfee by Network Associates 
Technologies Inc., PC-dllin by Trend Micro, Kapersky Anti-Vims by Kaspersky 
Lab, F-secure Anti-Virus by F-Secure Corporation, ... 
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A specific advantage of the above described embodiments in the 
current Invention Is that the virus scanning software does not need to be 
updated on every local agent but that this Is restricted to updating of the virus 
scanning software of the central infrastructure 100. In this way the security 
level of the network 10 is increased significantly as the security does not 
depend on the punctuality of the different users of the network 10 to update 
their virus scanning software. If the scanned file has no virus it will be marked 
in the metabase 1 10 as being a virus finee file. If there is a virus found in a file 
the file will be marked as dangerous. A query will happen to the metabase 1 10 
to find all files over the network 10 having the same conupted hashing key. 
The result is a list of files with path, and assetname where the file is located. 
This infbmnation can be used to do actions to elemlnate the danger of found 
viruses on all local computing devices 50, i.e. all workstations, from the 
complete networt^ 10. In this way proactive virus scanning can be performed 
on other local computing devices 50, based on a virus detection on a first local 
computing device 50. Depending the policy defined for virus checking, the 
virus engine will inform an agent installed on the affected system to remove 
the file and if possible replace with either a recovered version delivered by the 
virus engine located on the central infrastructure 100, or a previous version of 
the file which didn't have the virus yet The latter can be done easily by 
searching the metabase for a previous version of that file, or it can be 
performed by searching an uninfected version on another local computing 
device 50. If an uninfected version cannot be r^rieved firom either another 
local computing device 50 or the metabase residing on 100, the virus scanner 
should have a feature which allows it to save a new disinfected copy of the file 
on the central infi-astructure 100. These advantages are also present for other 
content identifying packages. 

In an alternative embodiment, if a file having a new hash value has 
been identified in the network 10, instead of transfemng the file to the central 
Infrastructure, the file may be automatically shared locally and a remote 
checker then may transfer a file-system which allows to check the file across 
the network 10 using the file sharing. The content tagging still is performed by 
the server. In order to improve security, the accessibility to the shared file is 
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restricted to the server. Furthermore, a java applet could be transferred to the 
local agent to allow checking other files. 

The previous embodiments are an improv ement over a central virus 
checker which scans local computing devices 50 through the network 10. This 

5 is only possible if the local drives, e.g. C:\, D:\, .... are shared. Besides the 
dangers of sharing with respect to security, the local user also easily can 
change the local sharing properties thereby preventing the remote checker 
from checking the files. This is at least partly avoided with the cun-ent invention 
as changing the network 10 sharing properties does not influence the 

1 0 operation of calculating the hash value of new files and sending it to the central 
infrastructure 100. 

Another advantage is that it saves CPU time on the local computing 
device 50 as the CPU does not have to keep doing virus checking, it only has 
to calculate a one way function. It also saves network time : the administrating 
5 server does not have to update the virus checkers on the local computing 
devices 50 with vims updates, as a single central virus checker only is used 
and updated. 

Fig. 3 shows a method 200 of the content identification process 
triggered by the local agent on the local computing device 50 according to the 
20 above mentioned embodiments. The different steps that occur during the 
process, both on a local computing device 50 and on the central infrastructure 
100 are discussed. 

The content identification process is based on continuously scanning for 
new data or applications on the local computing device 50 by the local agent. 
25 This scanning for data and applications is limited by the policy mle for 
determining when the local agent should be triggered, as described above. If a 
"new" file has been detected the method for securing and controlling the 
network 10 by content Identification of new files is initiated. This is step 210. 
Method 200 then proceeds to step 212. 
30 In step 212, a hash value of the "new" file is calculated using a hashing 

function like MD5 or SHA-1. This calculation is performed by using some CPU 
time of the local computing device. Nevertheless, the amount of CPU time 
used is drastically smaller than the CPU time that would be necessary if e.g. a 
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conventional virus checker was used to check the file on the Jocal computing 
device 50. Method 200 then proceeds to step 214. 

In step 214, the hash value and the file source information is transfe rred 

from the local agent to the central infrastructure 100 of the network 10. If 
necessary, this transfer can be a secured transfer. vWiereby it is avoided that a 
virus which is positioned on a network connection changes both the file source 
Information or the hashing key during transport of this data. Such a secured 
transmission can be made over a known secure transmission route, via a 
tunnel, or using known session ecryption/decryption techniques. 

In step 216, the hash value is compared with the data already present in 
the metabase 110. As in the metabase 110, the hash values and file source 
Infomnatlon of all old files - i.e. every file that has been present on the network 
10 and that is not "new" as described above - present in the network 10 are 
stored, it is possible to check whether the file already is present in the network 
10. Therefore, if the hash value has been identified as new, this implies that 
the file is "new" for the whole network 10. If the file is new. method 200 
proceeds to step 218. If the hash value is not new, this means that somewhere 
on a local computing device 50 in the network 10, the file does already exist. In 
this case, there already exists content attributes describing the content of the 
file. Method 200 then proceeds to step 224. 

In step 218 the metabase agent triggers the local agent to transfer the 
file corresponding with the new hash value from the local compuUng device 50 
to the central infrastructure 100. The transferring of the file may be performed 
in a secured way, i.e. the file may be transfen-ed such that it cannot be 
influenced by a virus present at a network connection or such that, it if contains 
a virus, this cannot be spread over the whole network 10. To obtain this a 
known secure transmission route, a tunnel and/or known session 
ecryption/decryption techniques may be used. Method 200 further proceeds to 
step 220. 

In step 220 the file is loaded in the content identification engine 120 and 
the file is processed. For this processing CPU time of the central infrastructure 
100 is used. The content identification engine 120 can comprise, as described 
above, a conventional vinjs checker, a means for checking picture information, 
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a means for checking SPAM. etc. This can be a repetitive action where 
multiple content identification engines are called in turn. Method 200 then 

proceeds to step 222^ 

In step 222 content attributes, which identify the content of the file, are 

5 determined for the file. These content attributes are then stored in the 
metabase 110, thus allowing to identify the status of the file if, in future 
operations, the file is found 'new" on another local computing device 50. 
Method 200 then proceeds to step 224. Depending on the embodiment used, a 
following step may include the storing of the file on the central infrastructure 

0 100 and adding the path to this file to the metabase 110. This step is not 
shown in figure 3. 

In step 224 the content attributes are sent to the local agent. Based on 
this content attributes, the local agent perfomis an appropriate action in 
agreement vAVtx the policy rule set for these content attributes. This is 
5 performed in step 226. This can be e.g. deleting the file if it was infected, 
replacing the file with a previous version which was not infected. .... In a 
specific embodiment, the execution of appropriate actions based on the policy 
mles are triggered by the agent of the metabase 110, so that step 224 can be 
avoided. 

20 The content policy is a policy that determines what should be done with 

a file depending on the content attributes detemnined by the content 
identification engine 120. The content policy can comprise actions such as 
deleting the file, deleting the file and replacing it with a previous version, 
copying the file onto another computing device while leaving a copy on the 

25 originating computing device, moving the file onto another computing device 
while deleting the original file on the originating computing device, logging the 
presence of the file, changing the attributes of the file like hiding it or making it 
read-only, making the file unreadable, making the file un-executable, etc. The 
content policy will be executed by the local agent, e.g. when the content 

30 attributes are received from the central infrastructure 100. The content policy 
for that agent will be downloaded to the local computing device 50 by the 
agent from a central policy Infrastructure. 

Fig. 4 shows a method 300 of the content identification process 
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triggered by the content identification engine 120 according to the above 
mentioned embodiments The different steps that occur during the process, 
both on a local computing device 50 and on the central infrastructure 100 are 



discussed. 

5 This process typically is used in situations where new algorithms or 

tools are being used for content identification. Such new algorithms or tools 
can either be optimised algorithms and tools or previously uninstalled tools. As 
mentioned earlier this may be regulated by a policy : the triggering of the 
content identification process may be determined by the type of new 
1 0 algorithms and tools that are being used for content identification. 

Method 300 is initiated by change of the content identification engine 
120. e.g. by providing new algorithms or tools for the content identification 
engine 120. 

In the first step 302 of method 300 upon triggering, the metabase 1 10 is 
15 scanned for hash values corresponding with hashing keys. Method 300 then 
proceeds to step 304. 

In step 304, a file that corresponds with the hashing key is requested. 
This file can be either requested from the central storage on the central 
infrastructure 100 or it can be requested from a local computing device 60. The 

20 local computing device 50 then gives permission to the central infrastructure 
100 to upload the corresponding file. The path to the file corresponding with 
the hash value is available from the record corresponding with each hash 
value. If the record stores different paths all corresponding with a copy of the 
corresponding file, the agent on the central infirastructure 100 retrieves one 

25 copy of the file. e.g. by scanning the paths listed in the record until a local 
computing device 50 has been found that is at that time connected to the 
network 10 and that allows uploading of the file. Method 300 then proceeds to 
step 306. 

Once the file has been retrieved, the file is sent to the content 
30 identification engine 120. This is performed in step 306. The upgraded content 
Identification engine 120 then scans the content of the file and produces 
content attributes corresponding with the file. Method 300 further proceeds to 
step 308. 
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In step 308, the content attributes are stored in the metabase 110. to 
allow in future security steps to Immediately identify the content of the files. 
Method 300 further proceeds to step 310. 



In step 310. the content attributes are sent to every local agent that 
5 resides on a local computing device 50 whereon the con-esponding file is 
stored. The paths can be found in the record of the corresponding hashing l<ey 
stored in the metabase 110. In this step, content attributes are send to every 
file for which a path is mentioned in the record of the corresponding hashing 
key. Method 300 proceeds to step 312. 
10' In step 312, the local agent on the con-esponding local computing 

devices 50 executes the policy according to the content attributes and the 
according to the local computing device 50. 

One of the major advantages of the embodiments of the invention is 
that a file new to the entire network 10 only needs to be scanned once. If on 
15 another tocal computing device 50, an identical copy of this file is used, 
installed, opened or saved and closed, the file will be recognised by the central 
infrastructure 100 as being known to the network 10, In this way avoiding the 
need to re-check the content of the file. This especially is advantageous if the 
invention is used for networks 10 having a large number of local computing 
20 devices 50. 

When operating, the method and system for identifying the content of 
new files optionally can comprise checking 'the heartbeat' of the local agent at 
regular times, i.e. it can be checked whether the local agent is still running on 
the local computing device 50. This can avoid that a user locally shuts down 

26 the agent, thus making the local computing device 50 vulnerable. If the local 
agent has been shut down, the network administrator can be warned. 
Furthermore a warning message could be send to the local computing device 
50 thereby warning the user of the local computing device 50. The network 
administrator could also put the local computing device 50 in quarantine so 

30 that it can not damage other local computing devices 50 in the network 10. 
Furthermore, the central agent can also try to rerun the local agent. 

In a similar way. the method and system for identifying the content of 
new files optionally can check at regular times whether the local computing 
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device 60 is still connected to the network 10. If the local computing device 50 
is not connected to the network 10 anymore, the local agent may further 
operate, storing hashing keys of new files in a waiting list to be checked once 



the network connection is restored. In the mean time, the corresponding files 
5 may be put in quarantine or depending on the type of file e.g. may be 
prevented from being executed. 

The above described embodiments may be used as a content firewall 
for the drfferent computing devices connected to the external network. For 
every incoming/outgoing file. Incoming/outgoing message or 
10 incoming/oQtgoing data frame, the content firewall calculates the hash, checks 
whether this is new. checks whether it is tagged for specific content and 
enforces the policy associated with the specific content. 

In a further embodiment, another configuration for using the present 
invention as a content firewall is described. A schematic overview of a 
15 computer network wherein this method and system may be used, is shown in 
Fig. 5. Only one reconfigurable firewall electronic device 50, such as a local 
computing device which may be in the form of a dedicated reconfigurable 
firewall electronic device, is directly connected to an external network 400 such 
as e.g. the internet, and the remaining local computing devices 410. are not 
20 directly connected to the external network 400, but grouped in a network 
environment and only connected to the external network 400 by their 
connection to the electronic reconfigurable firewall device.. The external 
network may be any possible network available. It is a goal of the content 
firewall as represented by the reconfigurable electronic firewall device 50 to 
25 protect the network environment comprising the remaining local computing 
devices 410 from attacks originating from places and/or devices in the external 
network. The reconfigurable electronic firewall device 60 50 either contains a 
local copy of the metabase or it can use a high speed secured network to a 
central infrastructure 100 which is part of the internal network. This allows for 
30 fast queries through the metabase. During operation, the reconfigurable 
electronic firewall device 50 functioning as a content firewall performs the 
following actions : the hash value of incoming files or incoming messages or 
incoming data frames are calculated. Subsequently, the calculated hash 
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values are compared >«ith the metabase. which is either stored locally or by 
using a high speed secured network, and it is determined whether the 
incoming file, incomin g message or incoming data frame is new. Furthermore, 

it is checl<ed whether this file, this message or this data frame is tagged for 

5 specific content. Depending on the specific content, a policy is enforced which 
is associated with the specific content. This policy may be to let it pass through 
to its final destination, to drop it, to log it. to put it in quarantine, etc. This 
system requires sufficient CPU power, in order not to slow down the network 
speed noticeably. 

1 0 In the case where none of the local computing devices connected to the 

network is equipped with a removable device, i.e. allowing for non-scanned 
content to be opened or executed on that device, this is a very secure and 
managable setup. 

In another embodiment of the invention, a similar configuration for use 
15 of the present invention as a content firewall in promiscuous mode is provided. 
The content firewall thereby sees all traffic passing by. executes the hashing 
and comparing functions and contacts the agents to enforce a policy. The 
advantage of this approach is that there is no single point of failure and no 
bottleneck anymore and furthermore that still no resources are used on the 
20 local computing devices for calculating hashes. Furthermore, no bandwidth is 
used for contacting the central metabase. The disadvantage is that local 
agents need to be installed on all computing devices of the internal network. 

In accordance with the above described embodiments, the present invention 
includes a computer program product which provides the functionality of any of 

25 the methods according to the present invention when executed on a computing 
device. Further, the present invention includes a data carrier such as a CD- 
ROM or a diskette which stores the computer product in a machine readable 
form and which executes at least one of the methods of the invention when 
executed on a computing device. Nowadays, such software is often offered on 

30 the internet, hence the present invention includes transmitting the printing 

computer product according to the present invention over a local or wide area 
network. 
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Claims 

1 . A method for identiiying the content of a file in a networl< environment, 
said network environment comprising at least one local com puting device 

-finRed to a remaining part of the network environmeni including a wnlial 

5 infrastructure and, the method comprising 

- calculating a reference value for a new file on one of said at least one 

local computing devices using a one-way-function, 
-transmitting said calculated reference value to said central 
infrastructure, 

10 -comparing said calculated reference value with reference values 

previously stored within the remaining part of the network 
environment, 

- after comparing, 

- deciding that the content of the new file is already identified if a 
15 match between said calculated reference value and a previously 

stored reference value is found and retrieving the corresponding 
content attributes; or 

- deciding that the content of the new file is not yet identified if no 
match between said calculated reference value and any of the 

20 previously stored reference values is found, followed by said 

central infrastructure identifying the content of said new file and 
detennining content attributes corresponding with the content of 
the new file and storing a copy of said content attributes, 
- after deciding, triggering an action on said local computing device in 

26 accordance with saidjoontent attributes. 

2. A method according to claim 1, wherein the reference value is a hash 
value. 
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3. A method according to claim 1 or 2, wherein reference values previously 
stored are stored within the central infrastructure. 

4. A method according to the previous claim wherein said identifying the 
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content of said new file comprises scanning the new file for viruses using a 
anti-virus checker means on said central infrastructure. 



5. 



A method according to any of the previous claims furthermore 
comprising transferring the new file from the local computing device to the 
central infrastructure before said identifying the content of said new file Is 
performed. 



6. A method according to claim 5. furthermore comprising storing a copy of 
the new file on the central infrastmcture after said transferring the new file 



7. 



8. 



from the local computing device to the central infrastmcture 

A method according to any previous claim wherein said triggering an 
action on said local computing device In accordance with said content 
attributes may comprise replacement of the new file on the local computing 
device with a copy of a previous version of said new file. 

A method according to any previous claim, wherein said triggering an 
action on said local computing device in accordance with said content 
attributes may comprise replacement of the new file on the local computing 
device with another version of said new file restored from the remaining 
part of the network environment. 

9. A method according to claim 1 , 2. 3 or 4 furthemiore comprising sharing 
the new file on the local computing device to the central infrastructure 
before said identifying the content of said "new file is performed and 
whereby said identifying the content of said new file is performed by 
remotely identifying the content over the network environment. 

10. A method according to any of the previous claims, wherein said 
triggering an action on said local computing device in accordance with said 
content attributes is performed after transmitting the content attributes 
corresponding to the new file to the local computing device. 



28 



11. A method according to the previous claims wherein said Identifying the 
content of said new file comprises one or more of the group of scanning for 

adult content, scanning for Self Promotional Advertising Messages and 

scanning for copyrighted information. 

12. A method according to any of claims 1 to 3 or 5. whereby one local 
computing device links said network environment with an external network, 
said one local computing device acting as a content firewall as to protect 
the network environment. 

13. A computer program product for executing any of the methods as 
claimed In claims 1 to 12 when executed on a network. 

14. A system for identifying the content of a file in a network environment, 
said network environment comprising at least one local computing device 
linked to a remaining part the network environment which includes a central 
infrastructure and. said remaining part including a stored database, 
whereby the system comprises : 

-means for calculating a reference value for a new file on said local 

computing device using a one-way-function, 
-means for transmitting said calculated reference value to said central 

infrastructure. 

-means for comparing said calculated reference value with previously 

stored reference values from the datat)ase, 
whereby the system further comprises: 
- means for deciding whether the content of the new file is already 
identified based on comparison of said calculated reference value 
and reference values previously stored within the remaining part, 
. means located on the central infrastructure, for identifying the 
content of the new file and as to assign content attributes if the new 
file has not been identified yet and means for storing said content 
attributes within the remaining part, and 



29 



means for triggering an action on said local computing device in 
accordance with content attributes for said new file. 



A system according to claim 14 wherein said means for identifying the 
content of a file comprise an anti-virus checker means on said central 
infrastructure. 

16. A system according to claim 14 or 15 furthermore comprising means for 
storing a copy of the new file within the remaining part. 

17. A system according to any of claims 14 to 16 wherein said means for 
identifying the content of a file comprises one or more of the group of 
means for scanning for adult content, scanning for Self Promotional 
Advertising Messages and scanning for copyrighted information. 

18. A method for altering a system for identifying the content of a file in a 
network environment according to claims 14 to 17. said network 
environment comprising means for calculating a one-way function, at least 
one local computing device Jinked to a remaining part of the network 
environment including a central Infrastnjcture and means for identifying the 
content and, the method comprising 

-altering said means for identifying the content or said means for 
calculating a one-way function 

- scanning the remaining part of the network environment for reference 

values calculated with a one-way function 

- for each of said reference values, 

- requesting a file that corresponds with said reference value from 
said network environment 

- sending the file to means for identifying the content 

- identifying the content of said file and determining content attributes 
corresponding with the content of the file and storing a copy of said 
content attributes 

- sending the content attributes to every local computing device 
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containing tlie file 

after sending; triggering an action on said local computing device in 
accordance with said content attributes. 



19. A computer program product for executing the method as claimed in 
claims 1 8 when executed on a network. 

20. A machine readable data storage device storing the computer program 
product of any of claims 13 or 19. 

21. Transmission of the computer program product of any of claims 13 or 
19 over a local or wide area telecommunications network. 
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Abstract 



Method and system for securing software in a network 



5 A method and system for performing securing and controlling of a 

network using content identification of files in a network having a central 
infrastructure and local computing devices is presented. The method 
comprises calculating a hash value of a new file created or received on a local 
computing device, transmitting the hash value to the central infrastructure. 

10 comparing the hash value with a previously determined hash value stored in a 
database on the central infrastructure to determine whether the file is new to 
the network and if the file is new to the network, checking the file content with 
a content identifying engine, installed and updated on the central 
infrastructure. Content attributes are determined for the files which allow to 

15 perform appropriate actions on the local computing devices according to policy 
rules. 
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